Repository navigation
Conversation
npm audit --omit=dev --audit-level=moderate failed on undici 8.0.0-8.10.1 (high), which stopped both verify jobs before typecheck, tests and build. Lock regenerated with --package-lock-only; only the undici entries change. After: 0 high, 0 moderate, 11 low (below the gate's moderate threshold). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Scaffold Handoff — For Your Coding Agent
Immutability CheckMode: advisory ✅ No immutable files were modified in this branch. Changed Files
Needs Adversarial Review — Do NOT Apply YetThese proposals passed the reject check but have not been approved by
Safety Boundary
Immutable files (never modify):
Scaffold files (safe to modify):
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
The direct dependency
undicigoes from^8.10.0(locked at 8.10.0) to^8.11.2(locked at 8.11.2). The lockfile was regenerated withnpm install --package-lock-only --ignore-scripts, and only the undici entries change: 2 files, 5 lines.Why
Both verify jobs run
npm audit --omit=dev --audit-level=moderatefirst. It failed on undici 8.0.0–8.10.1 (high), so typecheck, tests and build never ran. That blocked unrelated work, including #256. 8.11.2 is inside the app's existing^8.10.0range and keeps the samenode >=22.19.0engine.Evidence (local, same command as CI)
npm audit --omit=dev --audit-level=moderateexitThe 11 low advisories are below the gate's threshold and are not addressed here. They need their own assessment before anyone claims a zero-vulnerability audit.
Not verified locally
Typecheck, tests and build were not run locally. This PR exists so CI can reach them for the first time since the advisory landed.
🤖 Generated with Claude Code
Current automatic CI evidence — 2026-10-07
Both automatic PR CI and push CI verify that the production audit proceeds with 11 low findings and no moderate/high findings after this version update. Their installation summaries still report 18 total findings (11 low, 4 moderate, 3 high); this is not a zero-vulnerability result.
The next terminal blocker is
proofs:staleness:docs/eval/noderoom-fresh-user-vertical-proof.jsonis 38.7 days old against its 30-day window. CI requests a new proof batch or withdrawal of the associated claim. Fresh-room verification, SLO, typechecks, tests and build are downstream of this failure and did not run. This PR remains open pending honest freshness evidence and the remaining configured checks.Superseded by PR256 — 2026-10-09
Closing this PR as a superseded source change consolidates the active review in PR256. Its current head
c8789df42a425f6d101ecfac8e29a0cfa4b06eb9contains the complete, byte-identicalpackage.jsonandpackage-lock.jsonblobs from this PR's unchanged head9ca232963afaa445a0a10d50940a5a6286049365, together with the README onboarding update and a substantive before/after production-gate changelog. Neither of this PR's two changed files contains remaining unique work.This is source supersession, not a merge of the donor commit or a green-CI certificate. The donor branch
claude/undici-8.10.2, its head/history, and the original dated evidence above are retained; this closure does not move or delete any branch ref.The earlier donor CI still failed at the fresh-user proof's measured age of 38.7 days versus a 30-day window. The replacement's tested dependency amendment
f2a759improved the production-only audit from 12 findings (11 low, 1 high) to 11 low findings, while its PR CI failed at proof age 40.2 days and its push CI failed changed-area commit checking. The separate installation audit still reported 18 findings (11 low, 4 moderate, 3 high). These remain historical failures; no proof date, freshness policy, checker or authentication requirement has been reset or waived.Source equality does not establish current-head CI, fresh-room proof, SLO, typechecks, tests, build, production or merge readiness. Those remaining obligations continue in PR256 with their own exact-head evidence. The original paragraph saying this PR remained open describes its earlier dated state; this supersession note records the later consolidation decision.